{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:168eb41a-ee6f-575e-89ab-9bd762418fd0", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2", "type": "library", "group": "org.eclipse.jetty.websocket", "name": "websocket-server", "version": "9.4.41.v20210516-tuxcare.2", "purl": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bcab6db1-9a42-5eb7-a030-0665a2c3408c", "id": "CVE-2020-27216", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-27216 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2e2fc810-8f8d-51a8-b6f0-fbd311166791", "id": "CVE-2021-28169", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-28169 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server. Version 9.4.41.v20210516 is not vulnerable. Summary: The target repository (Jetty 9.4.41.v20210516) has the fix for CVE-2021-28169 applied. The vulnerability allowed doubly-encoded paths like '/%2557EB-INF/web.xml' to bypass security checks and access protected WEB-INF resources. The fix (commit 1c05b0bcb18) changed ConcatServlet.java line 130 to pass the original undecoded query parameter to RequestDispatcher instead of the decoded path, allowing the dispatcher's security me [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:81de4d6e-62c2-5088-9e44-0c53bc38e625", "id": "CVE-2021-34428", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34428 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3276f31f-e930-5909-bf66-9b506e305e64", "id": "CVE-2021-34429", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-34429 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:771c172a-82c1-5e38-a7aa-0b5c5607be6e", "id": "CVE-2022-2047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-2047 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a7c31150-4300-529b-b05e-1bd8e5fa5d2a", "id": "CVE-2022-2048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-2048 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:96dfd47b-df39-5734-8028-b0b90dba6a15", "id": "CVE-2023-26048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-26048 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:44c438ae-62dc-5440-b0f3-0258eed37bd6", "id": "CVE-2023-26049", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-26049 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:fdb8a063-c3e2-5d94-87ed-7ac6dc7dc2a5", "id": "CVE-2023-36478", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36478 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f9e00abe-e142-51d5-afde-c05d3048ddc8", "id": "CVE-2023-36479", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-36479 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1e5ab6a9-a63b-558b-9630-f6e991733942", "id": "CVE-2023-40167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-40167 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:09bc5295-a26b-5a99-a470-089a8065d62d", "id": "CVE-2023-41900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-41900 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f3d4782e-5464-52e3-a76d-b17855ecd4cc", "id": "CVE-2023-44487", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-44487 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:c29c2501-3574-5db1-b7d3-753f4ab6bad2", "id": "CVE-2024-13009", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-13009 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:28f873b4-3082-5701-b74f-c832839d84db", "id": "CVE-2024-22201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22201 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:ce88eece-a4da-5a11-b1ee-7729df841855", "id": "CVE-2024-6762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-6762 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:4eeb63ab-5b03-53fb-83a3-90b7b39fb990", "id": "CVE-2024-6763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-6763 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:aabef6ec-0645-5809-aeb1-af83f37e6296", "id": "CVE-2024-8184", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-8184 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:f4ebea9b-eb87-5284-9d9d-3e2a9a09ee5b", "id": "CVE-2024-9823", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-9823 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:d93027d1-9c8e-5bf0-ad8b-7fe2969140f5", "id": "CVE-2025-11143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-11143 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1809677b-d318-5cf4-a19f-d7e88806be87", "id": "CVE-2025-5115", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-5115 is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:96532a62-aa29-57e9-adb9-68eb63ee6483", "id": "CVE-2026-10050", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-10050 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:3ec7eef7-2e1d-586f-a6b0-1a6e18c3457d", "id": "CVE-2026-10051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-10051 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-10051. The vulnerability describes HTTP request trailer cross-request leakage in Jetty 12.x where the _trailers field was not reset between requests. However, Jetty 9.4.41 already contains the fix from upstream commit be1eb26670 (July 2017, Simone Bordet), which properly resets _trailers to null in the recycle() method called after each request..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1974ff59-fd49-5d7d-8267-647f700dd002", "id": "CVE-2026-1605", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-1605 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server. Version 9.4.41.v20210516 is not vulnerable. Summary: Target repository is Jetty 9.4.41.v20210516, which is outside the affected version range (12.0.0-12.0.31 and 12.1.0-12.0.5) and has a fundamentally different architecture that does not contain the vulnerable code patterns. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:a5e9e71a-9079-5806-9618-a8b0194578f4", "id": "CVE-2026-2332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-2332 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:1e8382e5-f440-5e39-8ea4-f142c8b4ddf7", "id": "CVE-2026-6790", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-6790 affects version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:68cc06d6-b8f9-598e-8ddd-88a70b12b6a8", "id": "CVE-2026-8384", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-8384 does not affect version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server. not_affected \u2014 Jetty 9.4.41.v20210516 is not affected by CVE-2026-8384. The target version includes upstream fixes from February 2021 (issue #4275, commits 20ef71fe5d7 and f9b5974dedf) that add ambiguous URI path parameter checking. These fixes prevent exploitation of the semicolon-followed-by-dot-segment pattern described in the CVE by rejecting such URIs with a BadMessageException before they reach security..." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }, { "bom-ref": "urn:uuid:2e62b6fb-3d28-5176-9617-546088e1fe23", "id": "GHSA-58qw-p7qm-5rvh", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-58qw-p7qm-5rvh is fixed in version 9.4.41.v20210516-tuxcare.2 of org.eclipse.jetty.websocket:websocket-server." }, "affects": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.eclipse.jetty.websocket/websocket-server@9.4.41.v20210516-tuxcare.2" } ] }